Imprivata Enterprise Access Management (EAM) versions 26.2.6 and below have a vulnerability. The platform uses an RSA key pair to generate its X.509 certificate for authentication. Crucially, there is no supported method to rotate this key pair after initial deployment. This means the same key is used indefinitely for certificate generation. Using a single, unchangeable key pair indefinitely is a significant departure from cryptographic best practices. If an attacker obtains the private key, they can indefinitely impersonate the EAM appliance. This impersonation allows the attacker to intercept authentication traffic, including credentials and SSO tokens for critical systems like EHRs. Previously captured encrypted traffic could also be decrypted retroactively if perfect forward secrecy is not enforced. Imprivata is aware of the issue and is reportedly working on a resolution. However, no fix or timeline has been released yet. In the interim, users should heavily restrict access to the appliance's private key, backups, and snapshots. Enforcing perfect forward secrecy on connections can also mitigate some of the impact.